VNX-1269: Product Released in Non-Release Configuration
A Python debugger hook is left in production code, so the shipped program stops at an interactive debugger prompt (hanging the worker, or handing a shell to whoever owns the terminal) or opens a remote-debug port that executes arbitrary code for anyone who connects. Reported, unconditionally reached (not inside an if that tests a debug, pdb, environment, settings, config, args or flag value): pdb/ipdb/pudb/rpdb/remote_pdb/web_pdb.set_trace(), pdb.post_mortem()/pm(), the built-in breakpoint(), a bare set_trace() or embed() imported from one of those debuggers or from IPython, __import__("pdb").set_trace(), IPython.embed(), debugpy.listen()/wait_for_client()/breakpoint(), ptvsd.enable_attach()/wait_for_attach(), pydevd/pydevd_pycharm.settrace() and code.interact(). Not reported: a debugger behind a debug flag or environment check, a method or function of the program's own named set_trace or breakpoint (obj.set_trace(), self.breakpoint()), test files, an interactive console that is the program's own feature (code.interact() or embed() inside a function named for a shell, repl or console, as flask shell is), and the names in comments and strings. DEBUG = True framework settings are reported by VNX-215.
| Field | Value |
|---|---|
| Rule ID | VNX-1269 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | Python |
| CWE | CWE-1269 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | product-released-in-non-release-config debugger python cwe-1269 |
| Source | internal/sast/rules/vnx-1269.rego |
Overview
VNX-1269 maps to CWE-1269: Product Released in Non-Release Configuration.
Why This Matters
A debugger hook left in shipped code stops the process at an interactive prompt. That hangs the worker, or hands a Python shell to whoever owns the terminal. A remote-debug listener (debugpy.listen, ptvsd.enable_attach) is worse: anyone who can reach the port can run arbitrary code.
What Gets Flagged
pdb.set_trace()
import ipdb; ipdb.set_trace()
breakpoint()
debugpy.listen(("0.0.0.0", 5678))
ptvsd.enable_attach(address=("0.0.0.0", 3000))Not flagged: a hook inside if args.pdb: or if os.environ.get("DEBUG"):, methods of your own named set_trace or breakpoint, test files.
Remediation
- Remove the breakpoint before release, and add a lint or pre-commit check (for example ruff
T100). - Put any debugging aid that has to stay behind an explicit, off-by-default setting.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1269
// nosec vnx-1269Or record an ignore rule: vulnetix ignore add --rule vnx-1269 --reason "...". See Suppressing findings.